Extracted

• • Target

    ea8983f958f442796a3e83244da7de62_JaffaCakes118

  • Size

    207KB

  • MD5

    ea8983f958f442796a3e83244da7de62

  • SHA1

    707084c45fdd313eae7eeb7a369ea94bbbf7445a

  • SHA256

    2234d95e29af8a2cd5a9e9e2e2f1c693d4741b509efe61aa113a8bbed53cbc59

  • SHA512

    84358213e86d35461382457115a37db8e975579fffcb8409f1d7c9305779d4d1452f647355b2e00657914e56145b5bfd4b467c21185163bd9d8d1d5b836a5633

  • SSDEEP

    3072:1Vg1cch3eku4/f5wDacak9Q4CvqSQJQt8DXB7/w24E2G/uipRpZUAE:/gKa3ekiWcakCKr52C3rM

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2